YunoHost/yunohost
1
0
Fork 0
mirror of https://github.com/YunoHost/yunohost.git synced 2024-09-03 20:06:10 +02:00
Code Issues Projects Releases Packages Wiki Activity

Rework _ynh_apply_default_permissions, only check if target is a child of install_dir.

Browse source
This commit is contained in:
Salamandar 2024-06-28 14:43:46 +02:00
parent 87eedc2a36
commit 8846381d47
1 changed files with 21 additions and 26 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

47
helpers/helpers.v2.1.d/utils
View file

@ -226,41 +226,36 @@ ynh_app_upgrading_from_version_before_or_equal_to() {
dpkg --compare-versions $YNH_APP_CURRENT_VERSION le $version dpkg --compare-versions $YNH_APP_CURRENT_VERSION le $version
} }
# Check if we should enforce sane default permissions (= disable rwx for 'others') # Apply sane permissions for files installed by ynh_setup_source and ynh_config_add.
# on file/folders handled with ynh_setup_source and ynh_config_add
# #
# [internal] # [internal]
# #
# Having a file others-readable or a folder others-executable(=enterable) # * Anything below $install_dir is chown $app:$app and chmod o-rwx,g-w
# is a security risk comparable to "chmod 777" # * The rest is considered as system configuration and chown root, chmod 400
#
# Configuration files may contain secrets. Or even just being able to enter a
# folder may allow an attacker to do nasty stuff (maybe a file or subfolder has
# some write permission enabled for 'other' and the attacker may edit the
# content or create files as leverage for priviledge escalation ...)
#
# The sane default should be to set ownership to $app:$app.
# In specific case, you may want to set the ownership to $app:www-data
# for example if nginx needs access to static files.
# #
_ynh_apply_default_permissions() { _ynh_apply_default_permissions() {
local target=$1 local target=$1
chmod o-rwx $target is_subdir() {
chmod g-w $target # Returns false if child or parent is empty
chown -R root:root $target child=$(realpath "$1" 2>/dev/null)
if ynh_system_user_exists --username=$app; then parent=$(realpath "$2" 2>/dev/null)
chown $app:$app $target [[ "${child/$parent/}" != "$child" ]]
}
# App files can have files of their own
if ynh_system_user_exists --username="$app"; then
if is_subdir "$target" "$install_dir" || is_subdir "$target" "$data_dir"; then
chmod -R u=rwX,g=rX,o=X "$target"
chown -R "$app:$app" "$target"
chown "$app:www-data" "$target"
return
fi
fi fi
# Crons should be owned by root # Other files are considered system
# Also we don't want systemd conf, nginx conf or others stuff to be owned by the app, chmod -R 400 "$target"
# otherwise they could self-edit their own systemd conf and escalate privilege chown -R root:root "$target"
if echo "$target" | grep -q '^/etc/cron\|/etc/php\|/etc/nginx/conf.d\|/etc/fail2ban\|/etc/systemd/system'
then
chmod 400 $target
chown root:root $target
fi
} }
int_to_bool() { int_to_bool() {